Efficient Framework for Genetic-Algorithm-Based Correlation Power Analysis
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 1
Efficient Framework for Genetic-Algorithm-Based
Correlation Power Analysis
An Wang, Yuan Li, Yaoling Ding*, Liehuang Zhu, and Yongjuan Wang
Abstract—Various Artificial Intelligence (AI) techniques are will be greatly reduced. This is because identical modules of a
combined with classic side-channel methods to improve the cryptographic primitive, such as S-box operation on each bytes
efficiency of attacks. Among them, Genetic Algorithms based of intermediate states, are executed simultaneously. When we
Correlation Power Analysis (GA-CPA) is proposed to launch
attacks on hardware cryptosystems to extract the secret key focus on one module, the power consumption produced by the
efficiently. However, the convergence rate is unsatisfactory due to other modules is treated as noise and consequently improve
two problems: individuals of the initial population generally have calculation complexity. Key enumeration algorithms [6], [7],
low fitnesses, and the mutation operation is hard to generate high- [8], [9] and rank evaluation methods [10], [11], [12], [13]
quality components. In this paper, we give an analysis framework were proposed to enumerate candidate keys in decreasing order
to solve them. Firstly, we employ lists of sorted candidate key
bytes obtained with CPA to initialize the population with high of likelihood or estimate the rank of the correct key based
quality candidates. Secondly, we guide the mutation operation on partial information obtained by classic CPA or template
with lists of candidate keys sorted according to fitnesses, which attacks. These methods reduced required number of power
are obtained by exhausting the values of a certain key byte traces in attacks, while improve memory and/or calculation
and calculating the corresponding correlation coefficients with complexity a lot.
the whole key. Thirdly, key enumeration algorithms are utilized
to deal with ranked candidates obtained by the last generation In recent years, Artificial Intelligence (AI) techniques are
of GA-CPA to improve the success rate further. Simulation increasingly combined with side-channel attacks to improve
experimental results show that our method reduces the number the efficiency of key recovery. They are roughly divided into
of traces by 33.3% and 43.9% compared to CPA with key two categories. One is classification using machine learning
enumeration and GA-CPA respectively when the success rate methods, and generally requires profiling, such as support
is fixed to 90%. Real experiments performed on SAKURA-G
confirm that the number of traces required in our method is vector machine [14], [15], [16], neural network [17], [18],
much less than the numbers of traces required in CPA and GA- [19], decision tree [20], [21], rotation forest [20], [21], [22],
CPA. Besides, we adjust our method to deal with DPA contest self-organizing maps [16], [23], naive Bayes [16], [20], [24],
v1 dataset, and achieve a better result of 40.76 traces than the and so on. The other category is key recovery using heuristic
winning proposal of 42.42 traces. The computation cost of our evolutionary algorithms, and generally doesn’t require profil-
proposal is nearly 16.7% of the winner.
ing, such as genetic algorithms [25], [26] and hill climbing
Index Terms—Side-channel analysis, Correlation power anal- [27].
ysis, Genetic algorithm, Key enumeration, Mutation. Genetic algorithms [28] are a powerful category of AI
techniques in solving optimization problems. In 2015, Zhang
I. I NTRODUCTION et al. presented a Genetic-Algorithm-based CPA (GA-CPA)
[25], which took full use of information in the power con-
I N 1996, Kocher proposed side-channel attacks [1] which
showed great threats on cryptosystems. From 1999 to 2004,
several side-channel attack models were put forward, such as
sumption traces generated by multiple S-boxes. Ding et al.
also proposed a method using genetic algorithms to conduct
attacks on bitwise linear leakages in 2020 [26]. In these
template attacks [2], collision attacks [3], mutual information approaches, candidate keys were regarded as individuals, and a
analysis [4], and so on. In the past ten years, Correlation group of individuals constructed a population. The correlation
Power Analysis (CPA) [5] was widely used in side-channel coefficients are defined as fitnesses in order to assess the
attacks and physical security evaluations on cryptographic qualities of individuals. With the evolution of a population, the
devices. With the development of hardware technology, the average fitness of individuals becomes higher and higher, and
parallel implementation of S-box is more used as a way to accordingly candidate keys approximate to the target one grad-
improve the performance of cryptographic devices. Besides, ually. Consequently, the target key is recovered. The authors
high frequency clock will also cause power consumption traces claimed that GA-CPA improved the success rate significantly.
of the S-box to be superimposed. However, when CPA is However, its convergence rate and result are unsatisfactory due
applied in the analysis of these devices, the attack efficiency to following problems:
• Genes in the initial population are not so desirable
An Wang, Yuan Li, Yaoling Ding and Liehuang Zhu are with School of
Computer Science, Beijing Institute of Technology, Beijing 100081, China because their fitnesses are generally very low.
(email: wanganl, ly18, dyl19, liehuangz@bit.edu.cn). • Since the mutation operation usually generates good
Yongjuan Wang is with Institute of Cyberspace Security, Information Engi- individuals randomly, the evolution procedure always
neering University, Zhengzhou 450001, China (email: pinkywyj@163.com).
* Corresponding author. encounters local optimal problems, and new high-quality
Manuscript received April 19, 2005; revised August 26, 2015. individuals appear coincidentally with low probability
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 2
during evolution. section. In Section III, our new framework and is proposed,
• When the number of power traces is insufficient, the key and advantages of the key enumeration scheme used in it are
with the highest fitness is usually not the correct one, and analyzed. Section IV addresses the process of determining
genetic algorithms are prone to fall into local optimum, parameters and operators employed in our method by experi-
which makes it more difficult to recover the target key. ments. Comparisons of CPA (with/without key enumeration),
GA-CPA and our proposal based on simulation and real
experiments are shown in Section V. The detail of adjustments
A. Our contributions
that make our method applicable to DES are introduced in the
In this paper, we propose a framework for GA-CPA, which same section. After that, our proposal is compared with hill-
consists of three stages. It solves the three problems mentioned climbing-based method by launching attacks on DPA contest
above respectively, and improves the efficiency. AES-128 is v1 dataset. We conclude this paper in Section VI.
taken for example to illustrate the new framework. we list our
contributions as follows. II. P RELIMINARIES
• Classic CPA is employed to rank candidates of each key
A. Correlation Power Analysis
byte according to their correlation coefficients. Individ-
uals (candidate keys) in the initial population of GA- Correlation power analysis proposed by Brier et al. [5]
CPA are generated by combining 16 key bytes which are is based on the dependence between power consumption
selected randomly from a set of candidates, whose cor- and Hamming distances of handled data of an cryptographic
relation coefficients is larger than the others. Therefore, devices. A linear model W = a×HW(D ⊕R)+b is presented
average fitness of individuals in the initial population is to define the relationship between the power consumption
inherent high. W and the Hamming distance from current state D to last
• The correlation coefficient optimization problem dis-
state R, denoted as H. In the formula, a stands for a scalar
cussed in this paper is affected by S-box (high-order gain depending on the circuit, and b encloses offsets, time
Boolean function). The variation of the key byte has dependent components and noise of the cryptographic device.
a complex and discontinuous effect on the correlation The correlation coefficient between W and H,
coefficient. Therefore, we propose a mutation scheme, cov(W, H)
ρW,H = ,
which is to sort the candidate values of key bytes ac- σW σH
cording to their fitness, and then select the byte with is used to achieve CPA attacks on cryptographic devices, in
the largest fitness as the mutation direction. Our scheme which candidate values of a key byte is scanned exhaustively
aims to improve the quality of the mutation results, and ranked according to correlation coefficients that they
which improves the mutation efficiency and speeds up produced with W . As a result, the target key is recognized
the algorithm convergence. as the one that corresponds to the maximized |ρW,H |.
• Due to the ranking procedure of each key byte, key
enumeration algorithms can be combined easily. If the
B. Genetic Algorithm
best individual of the last generation is not the target key,
candidates of each key bytes will be ranked according to Genetic algorithm [28] is a probabilistic optimization
fitnesses, which are calculated with other key bytes fixed method, which is inspired by the model of natural evolution.
to the best individual. Key enumeration algorithms are Potential solutions are defined as individuals, and the fitness
employed to search for the correct key with these ranking of a certain individual is evaluated by an objective function.
lists. For each individual, the higher its fitness is, the more likely it
Simulation and real experiments are conducted to compare is the optimal solution.
the efficiency among our method, GA-CPA and CPA with The basic procedure of genetic algorithm is that a popula-
key enumeration. Experimental results show that convergence tion constructed by npop individuals and initialized randomly
rate of genetic algorithms is improved by the new framework. evolves by three operations, namely selection, crossover and
Besides, our method requires only 66.70% and 56.14% traces mutation. These operations are executed in a loop, called
of CPA with key enumeration and GA-CPA respectively to a generation, and terminated when there is little changes
achieve 90% success rate. In addition, we launch attacks on between two generations. At the end of genetic algorithms,
DPA contest v1 dataset, and compare required numbers of the individual that has the highest fitness is outputted as the
traces and computation costs between our method and the optimal solution. The major functions of the three operations
winning proposal. The results show that our method performs are as follows:
better than the winning one both in the required number of • Selection is an operation that improves the average fitness
traces (1.66 less) and the computation cost (83.30% less). of a population by selecting individuals with higher
fitnesses. There are various schemes designed to handle
different problems, such as tournament selection [29],
B. Organization roulette wheel selection [30], truncation selection [31],
The rest parts of this paper are organized as follows. and so on.
Section II gives a brief description of classic CPA and GA- • Crossover is an operation that intends to assemble high-
CPA. Some imperfections of GA-CPA are exposed in this quality components in one individual by exchange bit
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 3
strings between two selected individuals (called parents). Algorithm 1 Genetic-Algorithm-based Correlation Coefficient
This operation is generally executed by a certain proba- Analysis.
bility pc . Input: threshold of generation th, size of population npop ,
• Mutation is an operation that generates new bit strings by probability of crossover pc , probability of mutation pm , a
altering one or a few bits in an individual. This operation set of power traces T .
provides local searching for most problems. However, it Output: the optimal key Kbest .
is executed by a very low probability pm , in order not to 1: P :=InitPopulation(npop );
influence the convergence. 2: ComputeFitness(P, T );
3: f ound :=false;
C. Genetic-Algorithm-based Correlation Power Analysis 4: generation := 0;
5: while !f ound and generation < th do
Zhang et al. [25] presented a GA-CPA method which com-
6: Pchild := Φ;
bined CPA with genetic algorithms to improve the efficiency
7: for j := 1 to npop /2 do
of power analysis in 2015. Genetic algorithm was employed to
8: child1 :=Selection(P);
obtain the optimal correlation coefficient produced by a whole
9: child2 :=Selection(P);
key but avoid exhausting all candidates.
10: Crossover(child1 , child2 , pc );
In GA-CPA, candidate keys are defined as individuals,
11: Mutation(child1 , pm );
and the correlation coefficient produced by the
12: Mutation(child2 , pm );
intermediate states (encrypted by the candidate key)
13: Pchild :=Pchild ∪ {child1 , child2 };
is the fitness, formally defined as F itness :=
14: end for
Corr(T race, Intermediate(P laintext, Candidate Key)).
15: P := Pchild ;
At the beginning of the algorithm, A group of individuals
16: ComputeFitness(P, T );
is generated randomly, called a population. The fitnesses
17: Kbest :=MaxFitness(P);
of individuals are calculated and sorted. Then, GA-CPA
18: if Verify(Kbest ) = true then
performs selection, crossover and mutation operations
19: f ound :=true;
in sequence on this population to obtain a population
20: end if
composed of new individuals. In this process, high-quality
21: generation := generation + 1;
individuals are retained and the population fitness improves.
22: end while
Finally, calculate fitnesses of the new individuals. If the
23: return Kbest ;
optimal solution (correct key) is found, the algorithm ends.
Otherwise, the above three basic operations are repeated until
the upper limit of iteration is reached. Algorithm 1 describes
components (i.e. correct key values). What’s more, there might
GA-CPA with pseudo code.
be even no correct value for some key bytes in the initial
InitPopulation(npop ) initializes population P with npop
population, which will increase the requirements for the ability
individuals. ComputeFitness(P, T ) computes fitnesses of
of the mutation operation to generate them.
individuals in P with a set of power traces generated
Thirdly, in many practical attacks, it is hard to acquire
by target cryptographic device. Selection(P) selects high-
sufficient power traces, which leads to a high signal to noise
quality individuals child1 and child2 from P randomly.
ratio. As a consequent, the fitness produced by the target key
Crossover(child1 , child2 , pc ) recombines child1 and child2
may be very close to wrong guesses, may even not be the
with probability pc , and Mutation(child1/2 , pm ) mutates
highest. At this condition, GA-CPA fall into local optimum
child1/2 with pm . Pchild acts as an intermediate population
easily, i.e. converge to a wrong or an immature solution.
that holds individuals among iterations. MaxFitness(P) out-
In our approach, we aim at solving these three problems.
puts an individual Kbest which produces the largest fitness in
P. Verify(Kbest ) tests whether Kbest is the correct key.
III. A F RAMEWORK FOR G ENETIC -A LGORITHM - BASED
C ORRELATION P OWER A NALYSIS
D. The Problem of Genetic-Algorithm-based CPA
Firstly, GA-CPA is supposed to converge to the correct key A. Description of New Framework
gradually. However, it is infeasible for the mutation operation Similar to GA-CPA, we regard candidate keys as indi-
to generate a correct key byte gradually by altering one (even viduals, and initial a population with a group of randomly
a few) bit randomly, because the outputs of S-box operations generated candidates. On the whole, our new framework of
are changed largely and irregularly along with a little altering GA-CPA consists of three stages, which is illustrated in Figure
in the input. Therefore, in a certain attack, GA-CPA is almost 1.
reduced to a random search for some key bytes. That is to At the first stage, random plaintexts are encrypted by AES-
say the evolution procedure always encounters local optimal 128 and the corresponding power traces are acquired. A
problems. Consequently, the convergence rate is unsatisfactory. classical CPA is conducted on these power traces, in order
Secondly, since the population is initialized randomly, av- to obtain a preliminary ranking of the candidate values for
erage fitness of individuals are usually very low. It requires each key bytes. These rankings are based on the correlation
quite a lot generations to obtain individuals with high-quality coefficients produced by the power traces and intermediateJOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 4
Stage1：Initialization Power Trace Acquisition
16 Key Byte CPA
1000 Encrypt 1000
Ranks
Plaintexts Traces
Population Initialize
Stage2：Evaluation
For Each Leakage
Mutate Current Key Analyze
Generation
Fitness
Compute Rank 1000
1000 Key
Intermediate
Points
Compute Values
Yes No
Mutation? Fitness
Correlation
For Each
Coefficient
Individual
Select and No Find Correct Key or
Crossover Exceed Iteration Limit
Yes Stage3：Key Enumeration
Yes Find the No Rank Candidates
Success Correct Key of Each Key Byte Enumerate
based on Fitness
Fig. 1. The flow chart of our new framework for genetic-algorithm-based correlation power analysis.
values corresponding to each key byte, respectively. Then, 16 P is defined as a two-dimensional array, in which P[s][i]
key byte rankings are obtained. Key bytes are chosen randomly represents the i-th byte of the s-th individual. Klist indicates
from a set of candidates whose correlation coefficients are a list of 256 candidates of one key byte. Each element in
larger than the others (according to the ordered list). The Klist stores a candidate value Klist [j].value and its corre-
size of the set is denoted as ninit , implying that these lation coefficient Klist [j].cor, which is calculated by Com-
candidates are the Top ninit items of each rankings lists. puteCor(j, T ) using the Hamming weight of j and the set
16 key bytes from 16 sets are combined to constitute the of power traces T . Sort(Klist ) arranges all elements of Klist
initial population. We give the outline of initialization stage from largest to smallest according to correlation coefficients.
based on rankings of candidates in Algorithm 2, denoted as RandomChoose(Klist , ninit ) selects a candidate value from
InitPopulationBR(npop , ninit , T ). the top ninit elements in Klist and initializes P[s][i].
The second stage implements the evolutionary process.
Compared with Zhang et al.’s method, our new framework
Algorithm 2 Initialization function InitPopulationBR(npop , mutates individuals based on ranking lists of candidates de-
ninit , T ) based on CPA. pending on fitnesses. The specific steps are as follows.
Input: size of population npop , selection range in the key
• Compute all fitnesses of individuals in the population.
ranking ninit , a set of power traces T .
Verify correctness of the key that has the highest fitness in
Output: the initial population P.
current generation with a pair of plaintext and ciphertext.
1: for i := 1 to 16 do
If it is the target one, attack is successfully done, else
2: for j := 0 to 255 do
perform the following steps.
3: Klist [j].value := j;
• Execute traditional selection and crossover operations,
4: Klist [j].cor := ComputeCor(j, T );
and obtain an intermediate population.
5: end for
• In mutation operation, for each key byte of an individual
6: Sort(Klist );
decide whether to mutate according to a randomly gen-
7: for s := 1 to npop do
erated decimal in [0, 1] by comparing it to the mutation
8: P[s][i] := RandomChoose(Klist , ninit );
probability pm .
9: end for
• For each mutation key byte, rank 256 candidates accord-
10: end for
ing to their corresponding fitnesses, which are calculated
11: return P;
with power traces and intermediate states produced byJOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 5
keys with 1 byte traversing 256 values and the other 15 and obtain our framework of genetic-algorithm-based correla-
key bytes fixed to the original individual. Choose the top tion power analysis.
one as the mutation result of this byte.
• Repeat the steps above until the correct 16-byte key is
B. Advantage of the Key Enumeration Scheme in New Frame-
found, or the number of generations reaches a threshold.
work
Zhang et al. gave experiments when they proposed GA-
CPA, which show that the more correct key bytes, the higher In this section, we use guessing entropy [32] to illustrate
the fitness of the individual. It can also be seen from Figure the advantage of the key enumeration scheme in the new
3 that the more correct key bytes, the lower the guess entropy framework. The guessing entropy is a common measurement
of a single key byte, and the easier it is for the correct key of side-channel attacks. In particular, an attack outputs a key
to become the direction of mutation operations. Therefore, we guessing list g = {g1 , g2 , ..., g|K| } in decreasing order of
propose a mutation scheme, which is to traverse all possible probability with |K| being the size of the keyspace. So, g1
values locally and select the optimal direction for mutation. is the most likely and g|K| the least likely key candidate.
Pseudo code of the ranking-based mutation is shown in Algo- The guessing entropy is defined as the average position of the
rithm 3, denoted as MutationBR(K, pm , T ). K stands for an correct key in g. Obviously, the lower the guessing entropy, the
individual, and K[i] is its i-th byte. Klist indicates a list of higher the performance of the attack. In addition, we introduce
256 candidates of K. Each element in Klist stores a candidate a concept of average guessing entropy in this paper, which
value Klist [j].value and its fitness Klist [j].f it, which is refers to the average of guessing entropies of all key bytes to
calculated by setting K[i] to Klist [j].value and maintaining be recovered.
the values of other key bytes. Unlike ComputeCor(Klist [j], Since the classic key enumeration algorithms focus on one
T ), ComputeFit(Ctemp , T ) outputs the correlation coefficient key byte at a time, the power consumption of other key bytes
produced by a 16-byte key and the set of power traces T (i.e. contained in the power traces is regarded as noise, which
fitness), rather than the correlation coefficient produced by a has a great influence on the ranking of candidate values,
1-byte candidate and power traces. especially when the number of traces is small. In our method,
the Hamming weight of the other 15 key bytes is considered,
Algorithm 3 Mutation Function MutationBR(K, pm , T ) which offsets the noise interference to a certain extent and
based on Ranking. makes the ranking of candidate value closer to the correct
Input: individual about to mutate K, probability of mutation one. Taking AES-128 implemented in parallel for example, we
pm , a set of power traces T . show the advantage of our proposal compared with previous
Output: updated individual K. applications of key enumeration algorithms in CPA when
MutationBR(K, pm ) processing on the same group of power traces in Figure 2.
1: for i := 1 to 16 do Solid lines indicate average guessing entropies and dotted
2: p := Random(0, 1); lines stand for guessing entropies of the worst cases (the one
3: if p < pm then that ranks the last in all key bytes). Red lines with circles
4: for s := 1 to 16 do indicate our method, and blue ones with triangles stand for
5: Ktemp [s] := K[s]; CPA. Guessing entropies of our method are calculated by
6: end for ranking the candidates of each key byte according to corre-
7: for j := 0 to 255 do lation coefficients between power consumption and Hamming
8: Klist [j].value := j; weights of the whole intermediate states with the other 15 key
9: Ktemp [i] := j; bytes fixed to the correct ones. Guessing entropies of CPA
10: Klist [j].f it := ComputeFit(Ktemp , T ); are calculated by ranking the candidates of each key byte ac-
11: end for cording to correlation coefficients between power consumption
12: Sort(Klist ); and Hamming weights of the corresponding intermediate bytes
13: K[i] := Klist [0].value; with the other 15 key bytes regardless. It is obvious that when
14: end if the number of power traces exceeds a certain threshold, the
15: end for guessing entropies of our method are lower than classic ones
16: return K; which implies that the key enumeration algorithm will achieve
better efficiency.
For the third stage, ranked candidates of all key bytes with In order to further illustrate how our method works, we
their fitnesses are feed into key enumeration algorithms if give Figure 3 which shows that the average guessing entropies
the optimal key recovered by the genetic algorithm is not of key bytes reduce along with the number of correct key
the correct one. The difference between our proposal and the bytes increasing. These lines stand for the guessing entropies
classic key enumeration algorithms is that candidates of a key of a key byte, whose candidate values are ranked according
byte are ranked according to the fitnesses which are calculated to correlation coefficients between power consumption and
with the Hamming weight of a 128-bit intermediate state, Hamming weights of 128-bit intermediate states with x key
instead of the correlation coefficient of a single byte. bytes (random location) being correct and the other bytes
We replace InitPopulation() and Mutation() in Algorithm being random wrong values. The optimal individual of the
1 with InitPopulationBR() and MutationBR() respectively, last generation of genetic algorithms is supposed as the oneJOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 6
250 Algorithm 4 Byte-wise Crossover Scheme.
Distribution of Correct Candidates in CPA
225 Guessing Entropy of Worst Case in CPA Input: two individuals about to be recombined K1 , K2 ,
200
Average Guessing Entropy in CPA crossover probability pc .
Distribution of Correct Candidates in Our Proposal
Output: two updated individuals K1 , K2 .
Guessing Entropy
175 Guessing Entropy of Worst Case in Our Proposal
Average Guessing Entropy in Our Proposal 1: for i := 1 to nword do
150
2: p := Random(0, 1);
125
3: if p < pc then
100 4: temp := K1 [i]; K1 [i] := K2 [i]; K2 [i] := temp;
75 5: end if
50 6: end for
25 7: Return K1 , K2 ;
0
0 50 100 150 200 250 300
Number of Traces
by means of initialization and mutation operations, the Byte-
Fig. 2. Comparison of guessing entropy between our proposal and CPA. wise crossover scheme is used to ensures that the internal
structure of key bytes is not destroyed while generating new
individuals. Therefore, parameters we need to determine are
that has the most number of correct key bytes, so we feed it the size of initialization set for each key byte ninit , the size
with its ranking lists to key enumeration algorithms in order of population npop , the truncation probability pt ,the crossover
to improve the enumeration efficiency. probability pc and the mutation probability pm .
120 0 Correct Byte B. Parameters Used in Initialization Stage
1 Correct Byte
2 Correct Bytes Noting that the mutation operation on a single byte needs
3 Correct Bytes
Guessing Entropy of One Byte
100 to traverse and calculate the fitness of 256 candidate values,
4 Correct Bytes
5 Correct Bytes which is a huge amount of calculation, we empirically set npop
80 6 Correct Bytes to be 6. Experimental results given later confirms that this
7 Correct Bytes
8 Correct Bytes value ensures the effective execution of the algorithm while
60 9 Correct Bytes having reasonable computational complexity.
10 Correct Bytes
11 Correct Bytes
Before determining ninit , we prefer to give a threat model
40 12 Correct Bytes where the attacker can obtain only a limited number of
13 Correct Bytes traces, which is enough for generating a high-quality initial
14 Correct Bytes
20 15 Correct Bytes population but not enough for normal CPA. First, We conduct
simulation experiments, in which power consumption of S-
0
box operations is simulated by adding Gaussian noises with
0 50 100 150 200 250 300 350 400 450 500 standard deviation being σ = 3.0. Normal CPA is applied on
Number of Traces
different group of traces. The number of traces ranges from
Fig. 3. The relation between the number of traces and the guessing entropy 10 to 1000 by a step of 10, and the experiments is conducted
of one key byte calculated with different numbers of correct values for the for 100 times. The rankings of correct values for all the key
other 15 key bytes. bytes are collected during each execution. Figure 4 shows
the relation between the number of traces and the guessing
entropies of all key bytes. The green dots stand for the rankings
IV. O PERATORS AND PARAMETERS S ELECTION of the correct value of one key byte. The red line denotes the
average guessing entropy of all the 16 key bytes. The blue line
A. Operators Employed in the Genetic Algorithm denotes the guessing entropy of the worst case, i.e. the average
The mutation scheme used in our method is described in location of the correct value that ranks lowest among all the
section III-A, so we omit here. For the truncation selection 16 guessing lists. In fact, the guessing entropy of the worst
scheme, we test tournament selection, roulette wheel selection case determines whether normal CPA will recover all the 16
and truncation selection. Since the performance of the three key bytes. The blue line in Figure 4 indicates that when the
schemes is similar, we adopt a relatively simple truncation number of power traces reaches 500, normal CPA still cannot
option. The truncation selection randomly selects individuals guarantee the ranking of each correct value to be No. 1, i.e.
from the top npop ∗pt individuals in fitness, where npop stands the attack fails.
for the size of population and pt is called truncation prob- Then, based on the data shown in 4, we get Figure 5,
ability. Byte-wise crossover [33] is employed to recombine which shows the ratio of correct values ranking in top i
individuals, as shown in Algorithm 4. Key bytes with corre- (i ∈ {1, 5, 10, 20, 40, 60}). Lines in blue, red, green, cyan,
sponding positions in the two parent individuals are exchanged magenta and yellow stand for i = 1/5/10/20/40/60, respec-
with probability pc , which is called crossover probability. tively. From Figure 5, we know that when the number of
Since our method generates relatively high-quality key bytes power traces is greater than 500, the probability that the correctJOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 7
1
Probability of correct values in the initial population
250
Distribution of Correct Keys
225 Average Guessing Entropy 0.9
200 Guessing Entropy of Worst Case
0.8
Guessing Entropy
175
0.7
150
0.6
125
100 0.5
75 0.4
50 Initialize with Top 1
0.3 Initialize with Top 5
25 Initialize with Top 10
0.2
0 Initialize with Top 20
0 50 100 150 200 250 300 350 400 450 500 0.1 Initialize with Top 40
Number of Traces Initialize with Top 60
0
Fig. 4. The relation between the number of traces and guessing entropy. 0 100 200 300 400 500 600 700
Number of Traces
Fig. 6. The relation between the number of traces and the probability of the
value ranks in top 5/10/20/40/60 is 100%. Furthermore, we correct value in the initial population.
derive and calculate the probability that each correct value
to be selected into the initial population when using our ini-
tialization stage with ninit = 1/5/10/20/40/60, respectively, to reduce the probability of the correct values to be chosen in
and show them in Figure 6. The probability of a correct the initial population.
value to be in the initial population by randomly generation is
1 − (1 − 1/256)npop ≈ 0.023. The initialization stage aims at
covering correct values of key bytes as many as possible in the
initial population, in order to generate high-fitness individuals 1
in the subsequent generations. The experimental results in
Figure 6 confirm that our method improve the probability that 0.8
initialize the population with correct values of key bytes, even
Probability
0.6
when the number of traces is 10 (20 for ninit = 1).
0.4
1
0.2
0.9
0.8 0
20
18
0.7 16 1
14 5
12
0.6 10 10
8 20
6
Ratio
0.5 Size of Population 4 40 Size of Candidate Space
2 60
0.4
Fig. 7. The probability of the correct value in the initial population with
Ranked First
0.3 different ninit and npop .
Ranked in Top 5
Ranked in Top 10
0.2
Ranked in Top 20
0.1 Ranked in Top 40
Ranked in Top 60 C. Parameters Used in Genetic Algorithm
0
0 100 200 300 400 500 600 700 800 900 1000 Since there are only 6 individuals in a population, we
Number of Traces determine the truncation probability pt = 50% to ensure
the choice space while abandoning weaker individuals. The
Fig. 5. The relation between the number of traces and the ratio of correct
key byte in top 1/5/10/20/40/60. crossover probability pc and the mutation probability pm
influence the function of genetic algorithms together, so we
Finally, we calculate the probability of a correct value in the discuss them at the same time. We test each value of (pc , pm )
initial population pinit when ninit = 1/5/10/20/40/60 and by performing our new framework of GA-CPA on different
npop = 2/4/6/.../20, respectively. The number of traces is set group of traces for 100 times respectively. Considering that
to 220, which is the boundary value between initializing with the recombination of two individuals are the same for pc and
Top 1 and Top 5 according to Figure 6. From the results shown 1 − pc in our new framework, we have pc ranging from 0.05
in Figure 7, we know that when npop ≥ 6, pinit with ninit = 5 to 0.5 by a step of 0.05. pm is generally less than 0.1, so we
is the largest (highlight in red). Therefore, we determine the have pm ranging from 0.01 to 0.1 by a step of 0.01. 220 traces
value of ninit to be 5. It is an appropriate value for ninit to are simulated with Gaussian noise whose standard deviation
cover the correct values as many as possible and not too much is σ = 3.0. The number of recovered key bytes are collectedJOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 8
when the algorithm converge (generally after 50 generations), 16
Number of Recovered Key Bytes
and averaged for each value of (pc , pm ). Figure 8 shows the 14
relation between (pc , pm ) and the number of recovered key 12
bytes. Obviously, pm is the main factor that influences the 10
function of the new framework. Since the number of recovered 8
key bytes is nearly the same for pm ∈ [0.05, 0.1] and a
6
larger pm means a higher computation complexity, we chose
4
(pc , pm ) = (0.5, 0.05). GA-CPA
2 Our Proposal
0
0 10 20 30 40 50 60 70 80 90 100 110 120 130 140
Number of Generations
17
Number of Recovered Key Bytes
Fig. 9. The comparison of convergence rate.
16
15
B. Efficiency Comparison with CPA and GA-CPA in Simula-
14 tion Experiment
13 Furthermore, we conduct experiments to compare the effi-
12 ciency of our proposal with CPA (with/without key enumer-
11
ation) and GA-CPA by mounting attacks on the same group
0.5 of traces, whose size ranges from 10 to 1000. We employ
0.4 0.1 success rate to measure the performance of the two methods
0.3 0.09
0.08
0.2 0.06
0.07 in this section. The success rate is defined as the average
0.05
0.1 0.04 empirical probability that an attack recovered the target key.
0.03
pc 0 0.02
0.01 pm Each experiment is repeated for 400 times with different group
of randomly simulated traces (standard deviation of noise
Fig. 8. The relation between the number of recovered key bytes and (pc , pm ) σ = 3.0). We apply the key enumeration algorithm proposed
at the 50th generation.
by Veyrat-Charvillon et al. [6], and set the maximum number
In practice, parameters mainly depend on cryptographic of enumerations to be 220 . The parameters of our proposal are
algorithms and the framework of attacks, so the parameters de- described in section IV, and we chose appropriate parameters
termined in this section are applicable to the attacks mounted for the traditional GA-CPA with similar experiments. The
in the following section. size of populations chosen for the GA-CPA is 1000, and the
crossover probability and mutation probability are (pc , pm ) =
(0.5, 0.12). According to Figure 9, the maximal threshold
V. E XPERIMENTS AND E FFICIENCY
numbers of generations of the two methods are 50 and 100
A. Comparison of Convergence Speed respectively. Their success rates and computation costs are
The convergence rate directly determines the maximal displayed in Figure 10(a), Figure 11(a) and Figure 12(a).
threshold number of generations, and then affects the computa- The computation cost is estimated as the average number of
tion complexity. Therefore, we perform GA-CPA and our new calculations for correlation coefficients taken by our proposal,
framework on the same group of simulated traces (standard CPA and GA-CPA (shown in Figure 11(a)), and enumeration
deviation of noise σ = 3.0) to compare their convergence times taken by our proposal and CPA with key enumeration
rates. The experiment is repeated for 100 times, and power algorithms (shown in Figure 12(a)). In addition, experiments
traces are randomly generated in each time. Since the average on traces with σ = 5.0 are also conducted, and the results are
number of evaluation times is npop × 16 × pm × 28 + npop = displayed in Figure 10(b), Figure 11(b) and Figure 12(b).
6 × 16 × 0.05 × 256 + 6 = 1234.8, we set the number of The experimental results show that:
individuals in comparison experiments based on normal GA- • For σ = 3.0, it requires 210 traces for our proposal
CPA to 1300. Thus, the convergence rate can be compared to achieve 90% success rate, and the corresponding
based on the number of generations. Numbers of recovered computation costs are about 4.30 × 104 calculations of
key bytes are collected and averaged for every ten generations correlation coefficients and 0.68×105 enumerations. With
(≤ 140). Figure 9 shows the relationship between the number the same number of traces, the success rates of CPA with
of generations and the number of recovered key bytes for both key enumeration and GA-CPA are about 14% and 10%,
methods. The red line indicates our proposal, and the blue one and the corresponding correlation coefficient calculation
stands for the traditional GA-CPA. times are about 0.41 × 104 and 9.81 × 104 , respectively.
From the figure, we know that our proposal converges The enumeration times of CPA are 9.28 × 105 . The
after 50 generations, while the traditional one’s convergence average timing overhead of successful attacks (with 210
generation is nearly 100. Apparently, our method has a higher traces and σ = 3.0) based on our method is less than 1
convergence rate, and consequently a lower computation com- minutes on a PC (Intel Core E7500@2.93GHz 2.00GB).
plexity. • For σ = 5.0, it requires 310 traces for our proposal toJOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 9
1 4
#10
11
Correlation Ceofficient Calcalation Times
0.9
10 GA-CPA
0.8 Our Proposal
9 CPA
0.7
8
Success Rate
0.6 7
0.5 6
0.4 5
0.3 4
Our Proposal
0.2 CPA with Key Enumeration 3
GA-CPA 2
0.1
CPA
0 1
50 100 150 200 250 300 350 400 450 500 0
Number of Traces 50 100 150 200 250 300 350 400 450 500
(a) σ = 3.0. Number of Traces
1 (a) σ = 3.0.
4
0.9 #10
11
Correlation Ceofficient Calcalation Times
0.8 10 GA-CPA
Our Proposal
0.7 9 CPA
Success Rate
0.6 8
0.5 7
0.4 6
5
0.3
Our Proposal 4
0.2 CPA with Key Enumeration
GA-CPA 3
0.1
CPA 2
0
100 150 200 250 300 350 400 450 500 550 600 1
Number of Traces 0
(b) σ = 5.0. 100 150 200 250 300 350 400 450 500 550 600
Number of Traces
Fig. 10. The comparison of success rates among our proposal, CPA
(b) σ = 5.0.
(with/without key enumeration) and GA-CPA.
Fig. 11. The comparison of correlation coefficient calculation times among
our proposal, CPA and GA-CPA.
achieve 90% success rate, and the corresponding compu-
tation cost is about 5.30 × 104 calculations of correlation
coefficients and 1.16 × 105 enumerations. With the same are embedded before the S-box operations in this hardware
number of traces, the success rates of CPA with key implementation, our attacks are focused on the intermediate
enumeration and GA-CPA are about 30% and 6%, and the states before S-box operations of the last round and the
corresponding computation costs are about 1.04 × 0.414 ciphertexts. A time window that contains information of the
and 9.85 × 104 , respectively. The enumeration times of target intermediate state is preselected and the points in it are
CPA are 7.88 × 105 . averaged to obtain one value.
We mount attacks based on the three methods with the same
From the experimental results we know that:
group of traces respectively. The number of traces ranges from
• With the same number of traces, the success rate of our
20 to 1000 with a step of 20. Since we take AES-128 as an
method is much more than the others, calculations of example to discuss parameter selection in the previous section,
correlation coefficients are less than GA-CPA. we will continue to use these parameters to do real experiments
• Our method performs much better than the CPA when
on the same algorithm in this section.
combined with key enumeration algorithms. For CPA, we calculate the correlation coefficients corre-
• Our method has trade off between number of traces
sponding to all the values of each key byte. Figure 13 shows
and offline computation time. Although its computation the experimental results of the one that requires the largest
costs are larger than CPA, it is still affordable for a key number of traces to identify the correct value. The blue lines
recovery attack. stand for wrong guesses of this key byte and the red one stands
for the correct candidate. Obviously, the minimal threshold for
C. Efficiency Comparison with CPA and GA-CPA in Real attacks based on correlation coefficients of single key byte is
Experiments 500.
For real experiments, we encrypt random plaintexts with For GA-CPA, we collect fitnesses of the best individual in
a fixed key using AES-128 implemented on SAKURA-G each generation. Figure 14 shows the results of experiments
provided officially. 2000 power traces are acquired and stored with randomly initialized populations. The red line stands for
with corresponding plaintexts and ciphertexts. Since registers the fitness of the correct key. The blue one stands for theJOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 10
5
#10 1
11
Our Proposal 0.9
10
CPA with Key Enumeration 0.8
9
8 0.7
Enumeration Times
7 0.6
Fitness
6 0.5
5 0.4
4 0.3
3 0.2 Correct Key
Best Candidate in the Last Generation
2 0.1 Best Candidate in Each Generation
1 0
100 200 300 400 500 600 700 800 900 1000
0
50 100 150 200 250 300 350 400 450 500 Number of Traces
Number of Traces
(a) σ = 3.0. Fig. 14. The relation between the number of traces and fitnesses of the best
5 individuals in the first 100 generations in existing GA-CPA.
#10
11
10 Our Proposal
CPA with Key Enumeration
9 line indicates the fitness of the correct key. The blue one
8 indicates the fitness of the best individual obtained in the last
Enumeration Times
7 generation, and the cyan one stands for fitness of the outputs
6 after key enumeration algorithms. The green ones indicate the
5 best fitnesses of each generations. The cyan line coincides with
4 the red one at 180, telling that our proposal is compatible with
3 enumeration algorithms, and is significantly improved.
2
1
1
0.9
0
100 150 200 250 300 350 400 450 500 550 600 0.8
Number of Traces 0.7
(b) σ = 5.0.
0.6
Fitness
Fig. 12. The comparison of enumeration times between our proposal and
CPA with key enumeration. 0.5
0.4
0.7 0.3
0.6 Correct Key
0.2 Best Candidate in the Last Generation
0.5
Our Proposal with Key Enumeration
0.4 0.1 Best Candidate in Each Generation
Correlation Coefficient
0.3
0
0.2 100 200 300 400 500 600 700 800 900 1000
0.1 Number of Traces
0
-0.1 Fig. 15. The relation between the number of traces and fitnesses of the best
-0.2 individuals in the first 50 generations in our proposal.
-0.3
-0.4 From these figures, we know that the minimal number of
-0.5 Correct Candidate
-0.6 Wrong Candidates traces required for CPA is 500, for GA-CPA is at least 380
-0.7 and for our method is only 180. Ratios between our method
100 200 300 400 500 600 700 800 900 1000
and the other two are 16.00% and 47.36%, respectively. Note
Number of Traces
that, at the point N um traces = 420, the fitness of the best
Fig. 13. The relation between correlation coefficients and the number of key obtained by GA-CPA is lower than the correct one. In
traces for a single key word in classic CPA. fact, similar phenomenons occur almost in each experiment of
GA-CPA at different points. The major reason is that GA-CPA
converges before recovering all the key words, and the random
fitness of the best individual obtained by GA-CPA. The green
local search based on word-wise mutation is not effective
ones stand for the best fitnesses of each generations. From this
enough to generate the correct one after the convergence.
figure, we know that even if there are enough traces for GA-
CPA to achieve a high success rate, premature convergence
will still occur due to poor initial populations. D. Efficiency Comparison with Hill-Climbing-based Method
For our method, we also collect the fitness of the best on DPA Contest v1 Dataset
individual in each generation. Figure 15 shows the experi- DPA contest [34] is the first international benchmark refer-
mental results with randomly initialized populations. The red ence for side-channel attacks, which provides power consump-JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 11
tion traces of hardware implementation of DES [35]. The DPA TABLE I
contest v1 dataset was built with parallel implementation of C OMPARISON OF OUR PROPOSAL AND THE HILL - CLIMBING - BASED
METHOD
DES, which is suitable for heuristic algorithms. This dataset
comprises 81089 power traces of 20003 samples, which were Method Min Average Max
collected during encryptions with random plaintexts and a GA-CPA 35 61.12 116
Our Framework of GA-CPA 30 40.76 71
fixed key. Hill-Climbing-based Approach [27] 30 42.42 94
The hill-climbing-based approach proposed by Clavier et
al. [27] is a classic application of heuristic algorithms in
side-channel analysis, and is the winning proposal to the first
GHz 32GB RAM. Figure 16 shows the comparison of running
edition of the DPA contest. The authors considered full 56-
time. The blue line stands for the hill-climbing-based method,
bit guesses of the main key to optimally exploit the side-
the green line stands for normal GA-CPA and the red one
channel leakage. They used a maximum likelihood based
stands for our proposal. The time is calculated by seconds.
distinguisher as the objective function, and considered the
subkeys (K1 , K16 ) of the first and the last round in order to
900
cover all bits in the main key.
800 Normal GA-CPA
To compare our proposal with the hill-climbing-based Climbing Hill
method and GA-CPA, we apply our framework to the DPA 700 Our Proposal
Running Time (s)
contest v1 dataset. We change the fitness function to the 600
maximum likelihood based distinguisher, and adjust basic 500
definitions and operations to handle DES: 400
• An individual is defined as the 16 6-bit key words in K1 300
and K16 . 200
• For the initial process, rankings of candidates for each 100
key words is calculated by the maximum likelihood based 0
30 50 70 90 110 130 150 170 190
distinguisher instead of classic CPA. The one with the Number of Traces
lowest value ranks first.
• For mutation operations, candidates of each key word Fig. 16. The comparison of computation cost between our proposal and the
hill-climbing-based method.
are ranked according to fitnesses produced by fixing the
other key words in the individual. The one with the lowest
fitness is the mutation result. After all key words in K1 Compared with the hill-climbing-based method, our frame-
finish mutation, 40 corresponding bits in K16 are set work benefits from selection and crossover operations, making
according to K1 . Then, K16 are processed in the same it easier for correct key values to be aggregated in a single
way. individual. The convergence rate of the algorithm is accel-
• For key enumeration, ranked candidates with fitnesses of
erated, which reduces the computation complexity by more
all key words in both K1 and K16 are feed into key than 50%. In addition, the combined effect of crossover and
enumeration algorithms. Notice that the related 40 bits mutation improves the flexibility of individual evolution, and
of K1 and K16 in each enumeration are not always the to a certain extent avoids the loss of the correct key due to
same. But if K1 and K16 are correct, the related 40 bits the fixed route in the hill-climbing algorithm. Therefore, our
must be the same. method requires nearly 2 less power traces, especially with the
We conduct experiments with the source code provided by function of key enumeration algorithms.
the author of [27]. The parameters of our method are set as
pc = 0.5, pm = 0.3, ninit = 5. We set the maximal threshold
number of generation to be 200, and the maximum number of VI. C ONCLUSION
enumerations to be 220 . 100 runs of each method are carried
out to get min, average and max number of traces required to In this approach, we discuss the imperfections of using
recover the main key. According to the evaluation method of genetic algorithm to solve the correlation coefficient opti-
the competition, for each run, a random set of n = 30 traces mization problem, and put forward a GA-CPA framework
is built to launch the first attack. Then, attacks are conducted which not only improves the convergence rate of genetic
by adding an extra random trace to the set continuously until algorithm, but also reduces the number of traces required in the
all attacks are successful with the number of traces being n ∈ power analysis on cryptographic algorithms implemented with
{n, n + 1, ..., n + 99}. n is considered to be the number of parallel S-boxes and large noise. Besides, a key enumeration
traces needed to recover the key (according to the requirements algorithm is involved in the framework to improve the success
of DPA contest). Table I shows the comparison of n between rate. Experimental results show that our method performs
our proposal and the hill-climbing-based method. better than CPA with key enumeration algorithm, the classic
As for the computation cost, we run both methods 100 times GA-CPA and the hill-climbing-based method. We expect that
with numbers of random traces ranging from 30 to 190 by in addition to climbing hill and genetic algorithms, more
a step of 2, and record the time used. The experiments are heuristic approaches will be integrated into SCA, especially
carried out on a PC with Intel(R) Core(TM) i7-9750H @2.59 with fault attacks to improve its efficiency further.JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 12
R EFERENCES [22] L. Lerman, S. F. Medeiros, G. Bontempi, and O. Markowitch, “A ma-
chine learning approach against a masked AES,” in Smart Card Research
[1] P. C. Kocher, “Timing attacks on implementations of diffie-hellman, rsa, and Advanced Applications - 12th International Conference, CARDIS
dss, and other systems,” in Annual International Cryptology Conference. 2013, Berlin, Germany, November 27-29, 2013. Revised Selected Papers,
Springer, 1996, pp. 104–113. ser. Lecture Notes in Computer Science, A. Francillon and P. Rohatgi,
[2] S. Chari, J. R. Rao, and P. Rohatgi, “Template attacks,” in Interna- Eds., vol. 8419. Springer, 2013, pp. 61–75.
tional Workshop on Cryptographic Hardware and Embedded Systems. [23] L. Lerman, G. Bontempi, and O. Markowitch, “Side channel attack:
Springer, 2002, pp. 13–28. an approach based on machine learning,” Center for Advanced Security
[3] K. Schramm, T. Wollinger, and C. Paar, “A new class of collision attacks Research Darmstadt, pp. 29–41, 2011.
and its application to DES,” in International Workshop on Fast Software [24] S. Picek, A. Heuser, and S. Guilley, “Template attack versus bayes
Encryption. Springer, 2003, pp. 206–222. classifier,” J. Cryptographic Engineering, vol. 7, no. 4, pp. 343–351,
[4] B. Gierlichs, L. Batina, P. Tuyls, and B. Preneel, “Mutual information 2017.
analysis,” in Cryptographic Hardware and Embedded Systems - CHES [25] Z. Zhang, L. Wu, A. Wang, Z. Mu, and X. Zhang, “A novel bit
2008, E. Oswald and P. Rohatgi, Eds. Berlin, Heidelberg: Springer scalable leakage model based on genetic algorithm,” Security and
Berlin Heidelberg, 2008, pp. 426–442. Communication Networks, vol. 8, no. 18, pp. 3896–3905, 2015.
[5] E. Brier, C. Clavier, and F. Olivier, “Correlation power analysis with a [26] Y. Ding, Y. Shi, A. Wang, Y. Wang, and G. Zhang, “Block-oriented
leakage model,” in International Workshop on Cryptographic Hardware correlation power analysis with bitwise linear leakage: An artificial
and Embedded Systems. Springer, 2004, pp. 16–29. intelligence approach based on genetic algorithms,” Future Generation
[6] N. Veyrat-Charvillon, B. Gérard, M. Renauld, and F.-X. Standaert, “An Computer Systems, vol. 106, pp. 34–42, 2020.
optimal key enumeration algorithm and its application to side-channel [27] C. Clavier and D. Rebaine, “A heuristic approach to assist side channel
attacks,” in International Conference on Selected Areas in Cryptography. analysis of the data encryption standard,” in The New Codebreakers -
Springer, 2012, pp. 390–406. Essays Dedicated to David Kahn on the Occasion of His 85th Birthday,
[7] D. P. Martin, J. F. O’Connell, E. Oswald, and M. Stam, “Counting keys ser. Lecture Notes in Computer Science, P. Y. A. Ryan, D. Naccache,
in parallel after a side channel attack,” in Advances in Cryptology – and J. Quisquater, Eds., vol. 9100. Springer, 2016, pp. 355–373.
ASIACRYPT 2015, T. Iwata and J. H. Cheon, Eds. Berlin, Heidelberg: [28] J. H. Holland, Adaptation in natural and artificial systems: an intro-
Springer Berlin Heidelberg, 2015, pp. 313–337. ductory analysis with applications to biology, control, and artificial
[8] R. Poussier, F.-X. Standaert, and V. Grosso, “Simple key enumeration intelligence. MIT press, 1975.
(and rank estimation) using histograms: an integrated approach,” in [29] J. Sampson and A. Brindle, “Genetic algorithms for function optimiza-
International Conference on Cryptographic Hardware and Embedded tion,” 1981.
Systems. Springer, 2016, pp. 61–81. [30] K. De Jong, “An analysis of the behavior of a class of genetic
algorithms,” Dissertation Abstracts International, vol. 36, 01 1975.
[9] L. David and A. Wool, “A bounded-space near-optimal key enumeration
[31] H. Mühlenbein and D. Schlierkamp-Voosen, “Predictive models for
algorithm for multi-subkey side-channel attacks,” in Cryptographers
the breeder genetic algorithm i. continuous parameter optimization,”
Track at the RSA Conference. Springer, 2017, pp. 311–327.
Evolutionary computation, vol. 1, no. 1, pp. 25–49, 1993.
[10] N. Veyrat-Charvillon, B. Gérard, and F.-X. Standaert, “Security evalua-
[32] J. L. Massey, “Guessing and entropy,” in Proceedings of 1994 IEEE
tions beyond computing power,” in Annual International Conference on
International Symposium on Information Theory. IEEE, 1994, p. 204.
the Theory and Applications of Cryptographic Techniques. Springer,
[33] Y. Ding, A. Wang, and S. M. YIU, “An intelligent multiple sieve method
2013, pp. 126–141.
based on genetic algorithm and correlation power analysis,” Cryptology
[11] A. Duc, S. Faust, and F.-X. Standaert, “Making masking security ePrint Archive, Report 2019/189, 2019, https://eprint.iacr.org/2019/189.
proofs concrete,” in Annual International Conference on the Theory and [34] T. P. S. R. Group, “DPA contest (1st edition) (2008-2009),” 2008,
Applications of Cryptographic Techniques. Springer, 2015, pp. 401– http://www.dpacontest.org/.
429. [35] National Bureau of Standards, “Data sncryption standard,” Federal
[12] C. Glowacz, V. Grosso, R. Poussier, J. Schüth, and F.-X. Standaert, Information Processing Standards Publications, 1977.
“Simpler and more efficient rank estimation for side-channel security
assessment,” in International Workshop on Fast Software Encryption.
Springer, 2015, pp. 117–129.
[13] R. Poussier, V. Grosso, and F.-X. Standaert, “Comparing approaches
to rank estimation for side-channel security evaluations,” in Interna-
tional Conference on Smart Card Research and Advanced Applications.
Springer, 2015, pp. 125–142. An Wang was born in 1983. He received the Ph.D.
[14] G. Hospodar, E. Mulder, B. Gierlichs, I. Verbauwhede, and J. Vande- degree from Shandong University in 2011. From
walle, “Least squares support vector machines for side-channel analysis,” 2011 to 2015, he held a postdoctoral position at
Center for Advanced Security Research Darmstadt, pp. 99–104, 2011. Tsinghua University. He is currently with the Beijing
[15] T. Bartkewitz, “Leakage prototype learning for profiled differential side- Institute of Technology. His main research interests
channel cryptanalysis,” IEEE Transactions on Computers, vol. 65, no. 6, include side-channel analysis, embedded systems,
pp. 1761–1774, 2016. and cryptographic implementation.
[16] H. D. Tsague and B. Twala, “Reverse engineering smart card malware
using side channel analysis with machine learning techniques,” in Big
Data, 2016 IEEE International Conference on. IEEE, 2016, pp. 3713–
3721.
[17] Z. Martinasek and V. Zeman, “Innovative method of the power analysis,”
Radioengineering, vol. 22, no. 2, pp. 586–594, 2013.
[18] E. Cagli, C. Dumas, and E. Prouff, “Convolutional neural networks with
data augmentation against jitter-based countermeasures,” in International
Conference on Cryptographic Hardware and Embedded Systems-CHES
2017. Springer, 2017, pp. 45–68. Yuan Li was born in 1997. She is currently in the
[19] J. Kim, S. Picek, A. Heuser, S. Bhasin, and A. Hanjalic, “Make some third year of a master’s degree at Beijing Institute
noise. unleashing the power of convolutional neural networks for profiled of Technology. Her research interest is side-channel
side-channel analysis,” IACR Trans. Cryptogr. Hardw. Embed. Syst., vol. attack.
2019, no. 3, pp. 148–179, 2019.
[20] S. Picek, A. Heuser, A. Jovic, and A. Legay, “Climbing down the
hierarchy: hierarchical classification for machine learning side-channel
attacks,” in International Conference on Cryptology in Africa. Springer,
2017, pp. 61–78.
[21] A. Heuser, S. Picek, S. Guilley, and N. Mentens, “Lightweight ciphers
and their side-channel resilience,” IEEE Transactions on Computers,
2017.You can also read
